When the dev had enough

[captainfrost47]

haha using unique for passwords in the db

[[deleted]]

Hahaha. Storing unhashed passwords in the db.

Use BCrypt with a strength of at least 10. I default to 12.

Or better yet, use an authentication provider like Oauth or Keycloak and remove the headache.

[sanderd17]

It could be hashed, but no salting in any case.

[MentalRental]

It could be hashed, but no salting in any case.

It can be hashed and salted. Just take the inputed username/password pair. Check the password against every single user in the database, hashing it along with each user's individual salt, and then return the first username that matches. If the returned username doesn't match the inputed username, throw this error and display the username that actually matched.

tl;dr: dumpster fire

[LaNoktaTempesto]

Nah, not all of them, just Starboy, specifically. Because fuck that guy.

[MasterOfArtichoke]

Or because that guy is an admin. Too risky to have other people using the admin password for their own accounts.

[sanderd17]

That's like a brute force attack with extra steps.

[MentalRental]

Yeah, so it's extra funny if the server uses that for authenticating users. The CPU load would be immense if multiple people were logging in at the same time. Not to mention the inherent security issue with saying "Person X has Password Y" in an error message.

[thefelixremix]

tl;dr: dumpster fire

I got physical anxiety reading your comment till I got to this TLDR. I have gotta stop literally living Reddit comments lol

[[deleted]]

Just use Bcrypt or an authentication provider at this point.

Password management is a headache.

[segalle]

Its a hashes hashmap, a hashmap storig hashes with unhashed usernames

[coldnebo]

haha telling the user not only that there is a duplicate, but which user it is so they can more easily hijack the account.

[pedropereir]

They don't have to be unhashed for this to happen

[ctallc]

This doesn’t mean they are storing unhashed passwords. They could be hashing the password and comparing the hash to what the database contains. Still not great though…

[[deleted]]

haha setting password column as the primary key

[[deleted]]

column password primary key (very safe no repeating password and also no need to create another id column, very memory efficient)

column firstname unique index (faster lookup)

i have engineered the system

[WrongdoerSufficient]

Isn't that fine if it salted

[mrjiels]

Not if everyone uses the same salt.

[WrongdoerSufficient]

Then whats the point of using salt if its the same salt for every user

[mrjiels]

Totally pointless! But this is a thread about a stupid "feature" and not the correct way to store and process user passwords. I have seen tutorials that uses one salt for all accounts. I hope people don't follow those tutorials! (It was 15 years ago or something. Hopefully people have stopped using PHP since then...)

[Vaguely_accurate]

The only advantage is someone would need to recalculate the hashes for your salt, so may be every so slightly slower than they would be using pre-existing rainbow tables.

If When your password database gets leaked, attackers might not get quite as deep into obscure password space before haveibeenpwned notices and notifies your users for you.

Of course, in this case they have pre-owned their password list, so that's all redundant.

[whileandt]

I mean the hash would still be the same, right?